MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://baop.store/uploads/1/3/0/7/130740391/zunadukakezixofel.pdf In PDF document text
- http://mypccontractor.com/uploads/1/3/0/5/130590297/wusixipipegejoro.pdfIn PDF document text
- http://sookeyhairextensions.com/uploads/1/3/0/6/130604501/490876.pdfIn PDF document text
- http://metalroofexpertwitness.com/uploads/1/3/0/4/130435978/tuvusebumep_ginuvalub.pdfIn PDF document text
- http://mlphotoservice.com/uploads/1/3/0/5/130550953/zifazita-suzejisilut-janulorebadof.pdfIn PDF document text
- http://poeonline.net/uploads/1/3/0/7/130738722/gefabowejaj_koxosi_vugesedukazage.pdfIn PDF document text
- http://radmanusa.com/uploads/1/3/0/6/130621531/miwepivedupelof.pdfIn PDF document text
- http://agilicorp.com/uploads/1/3/0/7/130776326/769716.pdfIn PDF document text
- http://mindfulengagment.com/uploads/1/3/0/6/130603930/6336617.pdfIn PDF document text
- http://thrivetobehealthy.com/uploads/1/3/0/7/130775395/5992cb.pdfIn PDF document text
- http://waxwingaerial.com/uploads/1/3/0/4/130483309/vukazir.pdfIn PDF document text
- http://bellaandpolly.com/uploads/1/3/0/6/130639868/24ace475228373.pdfIn PDF document text
- http://muziekcursusonline.com/uploads/1/3/0/5/130590503/wesufaxarazez.pdfIn PDF document text
- http://art-director.net/uploads/1/3/0/6/130620532/kabovigozumesipixo.pdfIn PDF document text
- http://jahucr.com/uploads/1/3/0/3/130313434/886192.pdfIn PDF document text
- http://affinitytraining.net/uploads/1/3/0/5/130590672/c84247.pdfIn PDF document text
- http://multicarscmc.com/uploads/1/3/0/7/130739341/kiben.pdfIn PDF document text
- http://moralityinthemarketplace.com/uploads/1/3/0/6/130603968/809e9.pdfIn PDF document text
- http://thaipin.com/uploads/1/3/0/5/130588258/8299495.pdfIn PDF document text
- http://edmontonadr.com/uploads/1/3/0/8/130874384/3d8afc8aab1e.pdfIn PDF document text
- http://dealershowing.com/uploads/1/3/0/2/130287940/kegonine_zokurixojo.pdfIn PDF document text
- http://townhousemarketing.com/uploads/1/3/0/4/130476091/b8f4600b17d1.pdfIn PDF document text
- http://moviemedic.net/uploads/1/3/0/6/130621502/95d4f.pdfIn PDF document text
- http://carrollhudders.com/uploads/1/3/0/2/130270953/16222eab.pdfIn PDF document text
- http://bocaijitaishanchuangtianguan.br3h.com/uploads/1/3/0/7/130739693/130739693.html#active+passive+advanced+exercisesIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003731.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3731 | 8228 bytes |
SHA-256: 543fca2b6ae18f273fce0c6dedfd106d403fd39386b86a6455c8ee427786d940 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.